feat(stream): add method to detect incomplete tool calls and handle parsing errors

src/app/subagent/engine.rs

@@ -54,8 +54,10 @@ fn build_subagent_tools(allowed_tools: &[String]) -> (Vec<Box<dyn crate::tool::T
 /// Why: matches the main agent's credential resolution exactly, so
 /// subagents automatically inherit the same provider settings.
 ///
-/// Return: `(api_key, model, optional_base_url)`.
-fn resolve_provider_config() -> (String, String, Option<String>) {
+/// Return: `(api_key, model, optional_base_url, provider_name)`. `api_key`
+/// is empty when every resolution path was exhausted — callers must check
+/// for this before issuing requests (see `run_subagent`).
+fn resolve_provider_config() -> (String, String, Option<String>, String) {
     let settings = crate::model::settings::Settings::load();
     let app_config = crate::model::app_config::AppConfig::load();
 
@@ -79,7 +81,21 @@ fn resolve_provider_config() -> (String, String, Option<String>) {
         }
     }
 
-    (api_key, model, base_url)
+    (api_key, model, base_url, settings.provider)
+}
+
+/// Reject an empty API key with an actionable error instead of letting the
+/// caller send a request that is guaranteed to fail once it reaches the network.
+///
+/// Return: `Ok(())` if `api_key` is non-empty, `Err` with a message naming
+/// `provider` and where to fix it otherwise.
+fn require_api_key(api_key: &str, provider: &str) -> anyhow::Result<()> {
+    if api_key.is_empty() {
+        anyhow::bail!(
+            "no API key configured for provider '{provider}' — set one in Settings or ~/.claude/settings.json"
+        );
+    }
+    Ok(())
 }
 
 // ─── Subagent-level tool gating (mirrors Harness checks) ───
@@ -325,7 +341,20 @@ pub fn run_subagent(ctx: &SubagentContext, tx: &mpsc::Sender<SubagentEvent>) ->
     // Cache provider config once before the loop instead of re-resolving
     // from disk on every step (Settings::load + AppConfig::load each parse
     // JSON files, and the config cannot change between steps).
-    let (api_key, model, base_url) = resolve_provider_config();
+    let (api_key, model, base_url, provider) = resolve_provider_config();
+
+    // Fail fast on a missing key instead of sending a doomed request: an
+    // empty api_key still reaches the network (base_url falls back to a
+    // default endpoint), so without this check every step burns a full
+    // 10-retry timeout/backoff cycle against a server that was never going
+    // to authenticate, and the real cause (no key configured) never
+    // surfaces past a buried WARN log.
+    if let Err(error) = require_api_key(&api_key, &provider) {
+        let error = error.to_string();
+        let _ = tx.blocking_send(SubagentEvent::StepFailed { step: 0, error: error.clone() });
+        anyhow::bail!(error);
+    }
+
     let client = crate::service::provider::LlmClient::new(api_key, model, base_url);
 
     for step in 0..ctx.max_steps {
@@ -559,3 +588,19 @@ pub fn run_subagent(ctx: &SubagentContext, tx: &mpsc::Sender<SubagentEvent>) ->
     let _ = tx.blocking_send(SubagentEvent::Completed { output: output.clone() });
     Ok(output)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn require_api_key_rejects_empty_key_with_provider_named_in_message() {
+        let err = require_api_key("", "claude").unwrap_err();
+        assert!(err.to_string().contains("claude"));
+    }
+
+    #[test]
+    fn require_api_key_accepts_non_empty_key() {
+        assert!(require_api_key("sk-live-abc123", "claude").is_ok());
+    }
+}